It is in the database (PostgreSQL usually, but MySQL is also
supported,
and for simple test setups even SQLite mostly works). The users' files
are all on disk (with the extension .dat regardless of the file type).
Peter